CVE-2021-32856 Microweber vulnerable to Cross-site Scripting

2023-02-2000:00:00

CWE-79

GitHub_M

www.cve.org

microweber

xss

vulnerability

versions 1.2.12

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

25.5%

JSON

Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. A fix was attempted in versions 1.2.9 and 1.2.12, but it is incomplete.

CNA Affected

[
  {
    "vendor": "microweber",
    "product": "microweber",
    "versions": [
      {
        "version": "1.2.12",
        "status": "affected",
        "lessThanOrEqual": "1.2.12",
        "versionType": "custom"
      }
    ]
  }
]